CVE-2006-2769

MEDIUM 5.0CVE-2006-2769 · Published 02/06/2006 · updated 16/06/2026

Package	Affected versions	Patched versions
snort sourcefire	`= 2.4= 2.4.1= 2.4.2= 2.4.3= 2.4.4`	No fix yet

Description

The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (\r) after the URL and before the HTTP declaration.

References

lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html
marc.info
secunia.com/advisories/20413 · Vendor Advisory
secunia.com/advisories/20766 · Vendor Advisory
securityreason.com/securityalert/1018
securitytracker.com/id · Exploit
demarc.com/support/downloads/patch_20060531 · Exploit
osvdb.org/25837 · Exploit
securityfocus.com/archive/1/435600/100/0/threaded
securityfocus.com/archive/1/435734/100/0/threaded
securityfocus.com/archive/1/435797/100/0/threaded
securityfocus.com/archive/1/435872/100/0/threaded
securityfocus.com/bid/18200 · Exploit
snort.org/pub-bin/snortnews.cgi
vupen.com/english/advisories/2006/2119 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/26855

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free